• 한국정보통신학회:학술대회논문집
• /
• 한국정보통신학회 2012년도 춘계학술대회
• /
• pp.823-826
• /
• 2012

본 논문에서는 클라우드 컴퓨팅 환경에서의 효율적인 네트워크 가상화 모델을 제안한다. 가상화는 서비스 지향 아키텍처를 구현하기 위한 핵심 기술이다. 즉, IT 인프라를 통해 변화하는 비즈니스 우선 순위에 따라 재사용 또는 결합 가능한 컴포넌트로 통합하는 표준화된 프레임워크이다. 가상화 기술 가운데 네트워크 가상화가 미래 인터넷에서 중요한 기술적 이슈로 부상하고 있으나 아직은 초기단계이기 때문에 네트워크 가상화의 개념과 세부 기술 등이 모호한 상태이다. 따라서 기존의 네트워크 가상화 기술을 분석하여 클라우드 환경을 위한 네트워크 가상화 모델을 제안한다.

• Journal of Information Processing Systems
• /
• 제14권6호
• /
• pp.1398-1404
• /
• 2018

High-performance computing (HPC) provides to researchers a powerful ability to resolve problems with intensive computations, such as those in the math and medical fields. When an HPC platform is provided as a service, users may suffer from unexpected obstacles in developing and running applications due to restricted development environments and dependencies. In this context, operating system level virtualization can be a solution for HPC service to ensure lightweight virtualization and consistency in Dev-Ops environments. Therefore, this paper proposes three types of typical HPC structure for container environments built with HPC container and Docker. The three structures focus on smooth integration with existing HPC job framework, message passing interface (MPI). Lastly, the performance of the structures is analyzed with High Performance Linpack benchmark from the aspect of performance degradation in network communications under Docker.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제6권11호
• /
• pp.2764-2783
• /
• 2012

Network virtualization supports future Internet environments and cloud computing. Virtualization can mitigate many hardware restrictions and provide variable network topologies to support variable cloud services. Owing to several advantages such as low cost, high flexibility, and better manageability, virtualization has been widely adopted for use in network virtualization platforms. Among the many issues related to cloud computing, to achieve a suitable cloud service quality we specifically focus on network and performance isolation schemes, which ensure the integrity and QoS of each virtual cloud network. In this study, we suggest a virtual network platform that uses Xen-based virtualization, and implement multiple virtualized networks to provide variable cloud services on a physical network. In addition, we describe the isolation of virtual networks by assigning a different virtualized network ID (VLAN ID) to each network to ensure the integrity of the service contents. We also provide a method for efficiently isolating the performance of each virtual network in terms of network bandwidth. Our performance isolation method supports multiple virtual networks with different levels of service quality.

• 디지털산업정보학회논문지
• /
• 제9권2호
• /
• pp.73-79
• /
• 2013

Cloud computing is a form which provides IT resources through network and pays the cost as much as you used. And it has advantages that it doesn't need to construct infrastructure and can be offered a variety of environments. The main core of these computing is virtualization technology. Security mechanism about attacks using vulnerabilities of virtualization technology isn't provided right and existing security tools can't be applied as it is. In this paper, we proposed honeyVM structure that can cope actively by collecting the information about attacks using virtualization vulnerability. Mamdani fuzzy inference is used to adjust dynamically the number of formed honeyVM depending on the load of system. Security structure to protect actual virtual machine from attacks and threats is proposed. The performance of the proposed structure in this paper measured occurred attack detection rate and resource utilization rate.

• 한국융합학회논문지
• /
• 제5권4호
• /
• pp.93-99
• /
• 2014

클라우드 컴퓨팅은 인터넷 기술을 활용하여 IT자원을 필요한 만큼 빌려서 사용하고 서비스 부하에 따라서 실시간 확장성을 지원받으며 사용한 만큼 비용을 지불하는 컴퓨팅 기술을 말한다. 클라우드 컴퓨팅의 핵심기술인 가상화는 서버, 스토리지 및 하드웨어 등을 분리된 시스템이 아닌 하나의 영역으로 간주하여 자원을 필요에 따라 할당하는 기술이다. 그러나 가상화 환경에서 필요로 하는 보안 메커니즘은 하나의 서버 내부가 아닌 서버 간의 트래픽을 모니터링 하도록 설계되어 있고 기본 수준의 가시성, 통제성 및 감사 기능을 갖는 기존 보안 메카니즘으로는 대응하기 어려운 상황이다. 본 논문에서는 클라우드 컴퓨팅 환경에서 가상화 기술의 보안 취약점을 분석하고 이를 토대로 가상화 기술과 관련된 하이퍼바이저 보안 및 게스트 OS 보안 권고 사항을 제시하고자 한다.

• ETRI Journal
• /
• 제43권5호
• /
• pp.932-940
• /
• 2021

Currently, research on network functions virtualization focuses on using microservices in cloud environments. Previous studies primarily focused on communication between nodes in physical infrastructure. Until now, there is no sufficient research on group key management in virtual environments. The service is composed of microservices that change dynamically according to the virtual service. There are dependencies for microservices on changing the group membership of the service. There is also a high possibility that various security threats, such as data leakage, communication surveillance, and privacy exposure, may occur in interactive communication with microservices. In this study, we propose an ID-based group key exchange (idGKE) mechanism between microservices as one group. idGKE defines the microservices' schemes: group key gen, join group, leave group, and multiple group join. We experiment in a real environment to evaluate the performance of the proposed mechanism. The proposed mechanism ensures an essential requirement for group key management such as secrecy, sustainability, and performance, improving virtual environment security.

• 정보보호학회논문지
• /
• 제23권6호
• /
• pp.1247-1257
• /
• 2013

클라우드 저장장치 가상화 환경에서는 기존의 컴퓨터 시스템 환경과는 다른 형태의 새로운 보안 취약점들이 발생하고 있으며, 기존의 보안 시스템으로는 이러한 보안위협요소들에 대해 적절한 대응이 어려우므로 기술적 해결 방안의 수립이 시급하다. 이를 위해서는 먼저 클라우드 저장장치 가상화 기술들을 상세하게 분석하고, 클라우드 저장장치 서비스를 이용하는 다양한 이해관계자들의 보안 요구사항을 조사하여, 보안 요구사항의 기술적 가이드라인에 대한 연구가 선행되어야 한다. 이에 본 논문은 클라우드 저장장치 가상화의 보안 요구사항 정의하고, 사용자 역할별 보안 요구사항과 시스템 계층별 보안 요구사항을 각각 도출하여 계층 및 역할별 보안 요구사항을 제안한다. 제안된 보안 요구사항은 가상화 보안 솔루션을 개발할 수 있는 기초를 제공할 것으로 예상된다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권12호
• /
• pp.5375-5400
• /
• 2016

IOMMU is a hardware unit that is indispensable for DMA. Besides address translation and remapping, it also provides I/O virtual address space isolation among devices and memory access control on DMA transactions. However, currently commodity virtualization platforms lack of IOMMU virtualization, so that the virtual machines are vulnerable to DMA security threats. Previous works focus only on DMA security problem of directly assigned devices. Moreover, these solutions either introduce significant overhead or require modifications on the guest OS to optimize performance, and none can achieve high I/O efficiency and good compatibility with the guest OS simultaneously, which are both necessary for production environments. However, for simulated virtual devices the DMA security problem also exists, and previous works cannot solve this problem. The reason behind that is IOMMU circuits on the host do not work for this kind of devices as DMA operations of which are simulated by memory copy of CPU. Motivated by the above observations, we propose an IOMMU para-virtualization solution called PVIOMMU, which provides general functionalities especially DMA security guarantees for both directly assigned devices and simulated devices. The prototype of PVIOMMU is implemented in Qemu/KVM based on the virtio framework and can be dynamically loaded into guest kernel as a module, As a result, modifying and rebuilding guest kernel are not required. In addition, the device model of Qemu is revised to implement DMA access control by separating the device simulator from the address space of the guest virtual machine. Experimental evaluations on three kinds of network devices including Intel I210 (1Gbps), simulated E1000 (1Gbps) and IB ConnectX-3 (40Gbps) show that, PVIOMMU introduces little overhead on DMA transactions, and in general the network I/O performance is close to that in the native KVM implementation without IOMMU virtualization.

• 디지털융복합연구
• /
• 제17권8호
• /
• pp.221-228
• /
• 2019

클라우드 컴퓨팅 활성화 정책에 따라 가상화 제품에 대한 보안 중요성이 증가하였으며, 보다 안전한 클라우드 환경을 운영하기 위해서는 가상화 제품에 대한 사이버 보안위협 분석 및 보안요구사항 개발이 필요하다. 본 논문은 가상화 제품에 대한 보안특징 및 사이버 보안위협 분석을 통해 보안기능 요구사항 개발을 위한 사전 연구 목적으로 수행되었다. 이를 위해, 미국 및 영국에서 가상화 제품의 보안성 평가를 위해 사용하고 있는 평가제도와 가상화 제품에 대한 보안위협, 보안목적 및 보안요구사항들을 비교했다. 또한, 가상화 제품의 보안특징과 관련된 핵심적인 보안기능 요구사항 개발을 위한 항목 및 절차를 제안하여 보다 안전한 가상화 제품 개발 및 보안 평가기준 마련에 기여하고자 한다.

• 한국군사과학기술학회지
• /
• 제26권1호
• /
• pp.91-101
• /
• 2023

Modeling and Simulation(M&S) technology has been widely used to solve constraints such as time, space, safety, and cost when we implement the same development and test environments as real warfare environments to develop, test, and evaluate weapon systems for the last several decades. The integration and test environments employed for development and test & evaluation are required to provide Live Virtual Construction(LVC) simulation environments for carrying out requirement analysis, design, integration, test and verification. Additionally, they are needed to provide computing environments which are possible to reconfigure computing resources and software components easily according to test configuration changes, and to run legacy software components independently on specific hardware and software environments. In this paper, an Integration Test and Simulation for Engagement Control(ITSEC) bed using a bare-metal virtualization mechanism is proposed to meet the above test and simulation requirements, and it is applied and implemented for an air missile defense system. The engagement simulation experiment results conducted on air and missile defense environments demonstrate that the proposed bed is a sufficiently cost-effective and feasible solution to reconfigure and expand application software and computing resources in accordance with various integration and test environments.